Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a few questions about security on my ubntu 12.04 LAMP server (newbie)

This is what I´ve done so far:

  • Install and configure Firewall - ufw
  • Secure shared memory - fstab
  • SSH - Disable root login and change port / adding ssh-key
  • Protect su by limiting access only to admin group
  • Harden network with sysctl settings
  • Disable Open DNS Recursion and Remove Version Info - Bind9 DNS
  • Prevent IP Spoofing
  • Harden PHP for security
  • Restrict Apache Information Leakage
  • Install and configure Apache application firewall - ModSecurity
  • Protect from DDOS (Denial of Service) attacks with ModEvasive
  • Scan logs and ban suspicious hosts - DenyHosts and Fail2Ban
  • Intrusion Detection - PSAD
  • Check for RootKits - RKHunter and CHKRootKit
  • Scan open Ports - Nmap
  • Analyse system LOG files - LogWatch
  • SELinux - Apparmor
  • Audit your system security - Tiger

    --------------------------------

    I am also using Cloudflare which has some security features out of the box.

    But should I install some sort of antivirus on my server?

    (I only have outgoing email, eg users register on my site and gets a email link sent) So I am blocking all INCOMMING emails to the server by loopback-only.

    Should I block ping-requests to my site?

    Or is it not a problem letting people ping my site? ping mysite.com ...

    Off-topic, my server seems to do a reboot on its own every sunday morning 7am. I havent started this my self with cron-jobs or so, but is there a way to disable it from doing self-reboot every sunday morning? Mostly coz some settings gets lost after a self-reboot has been done.

    Lastly, I am running a cron-job to do a run a function by calling:

    mysite.com/some-cron-job?secretKey=8934958398457
    

    Is it safe to use this method ?secretKey=8934958398457 then using php to check "secretKey" value and then run the cron-job if its equal to "8934958398457"

    Is there anything else I should do in order to make my server more secure?

    Thanks in advance!

  • share|improve this question

    closed as unclear what you're asking by Braiam, Kevin Bowen, Andrea Corbellini, Alaa Ali, Eliah Kagan Sep 13 '13 at 22:50

    Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

        
    Could you instead ask 1 question per post? Also, please demonstrate what is your final goal and how you plan to achieve it. Include what have you tried and what were the results, with what are you having troubles, etc. Always focussing in 1 problem at time/post. –  Braiam Sep 13 '13 at 2:58
        
    Sorry my first time posting here, but I will keep that in mind until next time. –  kevin svensson Sep 13 '13 at 15:22
        
    No, please edit the post now. Preferably in tone with the answer below. Also, if it solved the question, please accept it. –  Braiam Sep 13 '13 at 15:23

    1 Answer 1

    up vote 0 down vote accepted

    Let's just say that this system is secure enough to comply with HIPAA, so yeah, you are doing all right as far as security goes.

    You shouldn't need antivirus software. The OS is secure enough that nothing is going to be installed unless you tell it to be installed.

    Ubuntu does not reboot itself by default, so something must have changed that causes the reboot every week. I would look in the files in /var/log (where log files are kept) to see if you can figure out what application is calling the reboot. Whatever it is must have pretty high permissions to cause a reboot.

    About the secret key script: That should be ok as long as the job doesn't do anything that could cause damage or security issues. The odds of someone randomly hitting that URL is small, but you should still make sure that the script that gets invoked doesn't clear out your filesystem or something.

    share|improve this answer
        
    Thanks for your answer! I had to double check since this is my first time using ubuntu lamp, The script being called is just a php/mysql function, its just deleting old posts. –  kevin svensson Sep 13 '13 at 15:18
        
    No problem, dude. Hope this helps –  jkurtisr32 Sep 13 '13 at 15:27

    Not the answer you're looking for? Browse other questions tagged or ask your own question.